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SUBJECT;  Report  on  Quality  Control  Review  of  Deloitte  &  Touche,  LLP  and  Defense  Contract 
Audit  Agency  FY  2008  Single  Audit  of  The  Aerospace  Corporation 
(Report  No.  D-201 1-6-002) 

We  are  providing  this  report  for  your  information  and  use.  We  considered  management 
comments  on  a  draft  of  this  report  when  preparing  the  final  report*  As  the  cognizant  Federal 
agency  for  The  Aerospace  Corporation  (Aerospace),  we  performed  a  review  of  the  Deloitte  & 
Touche  and  the  Defense  Contract  Audit  Agency  (DCAA),  single  audit  and  supporting  working 
papers  for  the  audit  period  October  1, 2007,  through  September  30,  2008.  The  purpose  of  our 
review  was  to  determine  whether  the  audit  was  conducted  in  accordance  with  auditing  standards1 
and  the  auditing  and  reporting  requirements  of  Office  of  Management  and  Budget  (OMB) 

Circular  A- 133,  “Audits  of  States,  Local  Governments,  and  Non-Profit  Organizations,”  (Circular 
A-133),  Appendix  A  contains  additional  background,  scope  and  methodology  for  the  review. 

The  Deloitte  &  Touche  office  in  Los  Angeles,  California  performed  the  audit  of  the 
financial  statements.  Deloitte  &  Touche  and  the  DCAA  South  Bay  Branch  Office  in  Gardena, 
California  performed  a  coordinated  audit  of  the  research  and  development  program  cluster. 
Appendix  B  presents  the  research  and  development  compliance  requirements  and  the  division  of 
audit  responsibility  between  Deloitte  &  Touche  and  DCAA  for  the  audit  period  ended 
September  30, 2008. 


!  Auditing  standards  include  both  Government  Auditing  Standards  and  the  American  Institute  of  Certified  Public 
Accountants’  audit  standards. 


Background.  Aerospace  is  a  nonprofit,  Federally  Funded  Research  and  Development  Center, 
sponsored  by  the  United  States  Air  Force,  and  headquartered  in  El  Segundo,  California. 
Aerospace  also  provides  technical  support  to  space-related  programs  managed  by  other  Federal 
agencies,  international  organizations,  and  foreign  governments  when  in  the  national  interest. 

Aerospace  expended  $804.4  million  in  Federal  awards  for  the  fiscal  year  ended  September  30, 
2008,  under  one  Federal  program,  the  research  and  development  cluster.  Of  the  $804.4  million, 
$748.3  million  was  expended  for  Department  of  Defense  programs. 

Review  Results.  DCAA  did  not  comply  with  Circular  A- 133  reporting  requirements.  As  a 
result,  DCAA  must  revise  its  FY  2008  Circular  A- 133  report  on  compliance  and  internal  control 
to  include  findings  on  the  fraud  disclosed  by  Aerospace  management  and  a  significant  deficiency 
related  to  internal  control  over  compliance  with  the  cash  management  requirements.  We  also 
identified  deficiencies  in  the  performance  of  fraud  risk  assessment  procedures,  information 
technology  internal  control  testing  and  working  paper  documentation  that  need  to  be  corrected  in 
future  audits. 

The  Deloitte  &  Touche  audit  of  the  financial  statements  and  the  research  and  development 
program  cluster  generally  met  auditing  standards  and  Circular  A- 133  requirements. 

Aerospace  complied  with  Circular  A- 133  reporting  requirements.  However,  Aerospace  will 
have  to  resubmit  the  FY  2008  Circular  A- 133  reporting  package  and  data  collection  form  to  the 
Federal  Audit  Clearinghouse  upon  receipt  of  the  revised  DCAA  audit  report. 

Management  Comments  and  DoD  IG  Response.  DCAA  and  Aerospace  agreed  to  take  the 
recommended  actions.  Management  comments  were  responsive  and  conform  to  requirements; 
no  additional  comments  are  needed.  DCAA  management  comments  are  included  in  their 
entirety  at  the  end  of  this  report. 

Finding 

Performance,  Reporting  and  Documentation  of  the  Federal  Program  Audit. 

DCAA  did  not  plan  and  perform  sufficient  fraud  risk  assessment  procedures  and  they  failed  to 
properly  evaluate  a  deficiency  in  internal  control  with  cash  management  requirements  in 
accordance  with  auditing  standards  and  Circular  A- 133  requirements.  As  a  result,  the  auditors 
did  not  comply  with  Circular  A- 133  reporting  requirements  because  they  did  not  report  a 
disclosed  fraud  and  a  significant  deficiency  in  internal  control  over  compliance  with  cash 
management  requirements  as  findings  in  the  FY  2008  single  audit  report.  In  addition,  DCAA  did 
not  perfonn  all  the  planned  testing  of  key  information  technology  internal  controls  and  did  not 
adequately  document  their  working  papers  to  support  its  conclusions  for  the  compliance 


2 


requirements  tested  and  the  scope  of  audit  procedures  performed  by  the  DCAA  Field 
Detachment  office2. 

Fraud  Risk  Assessment  Procedures.  DCAA  did  not  perform  sufficient  fraud  risk 
assessment  procedures  during  the  planning  and  performance  of  the  audit.  The  Circular  A- 133 
audit  program  procedures  were  limited  to  evaluating  the  fraud  risk  indicators  identified  in  the 
DoDIG  “Handbook  on  Fraud  Indicators  for  Contract  Auditors.”  As  documented  in  the  audit 
working  papers,  the  evaluation  of  the  fraud  indicators  was  based  solely  on  infonnation  in  the 
permanent  files  and  auditor  experience  with  Aerospace.  Based  on  this  evaluation,  the  auditor 
concluded  that  there  were  no  indications  of  potential  fraud  which  would  require  additional  audit 
procedures. 

OMB  Circular  A- 133  requires  that  the  single  audit  be  perfonned  in  accordance  with  government 
auditing  standards  applicable  to  financial  statements,  which  incorporate  the  American  Institute  of 
Certified  Public  Accountants  (AICPA)  auditing  standards.  A1CPA  auditing  standard,  AU  §316, 
“Consideration  of  Fraud  in  a  Financial  Statement  Audit,”  requires  the  auditor  to  plan  and 
perfonn  the  audit  to  obtain  reasonable  assurance  that  material  misstatements  and  noncompliance, 
whether  caused  by  error  or  fraud,  are  detected.  Specifically,  as  a  means  of  obtaining  information 
needed  to  identify  fraud  risk  areas,  the  standard  requires,  among  other  procedures,  inquiries 
during  the  planning  process  of  the  organizations’  management  to  determine  if  they  have 
knowledge  of  any  fraud  or  suspected  fraud  affecting  the  entity.  The  standard  also  requires 
auditors  to  design  and  perfonn  procedures  in  response  to  identified  fraud  and  fraud  risks. 

DCAA  did  not  design  and  perform  additional  procedures  when  they  became  aware  of  an 
identified  instance  of  fraud  during  the  review  of  internal  control  over  compliance  with  the 
activities  allowed  or  unallowed  and  allowable  costs/cost  principles  requirements.  DCAA  was 
informed  by  the  Director  of  Internal  Audit  of  a  disclosed  fraud  involving  a  full-time  employee 
who  worked  for  another  government  contractor  while  employed  by  Aerospace  for  a  period  of 
several  years.  There  was  no  indication  in  the  audit  documentation  that  DCAA  considered 
designing  and  perfonning  procedures  in  response  to  this  identified  risk  of  labor  mischarging  as 
required  under  auditing  standards.  We  discussed  this  issue  with  the  audit  supervisor  and  were 
advised  that  the  auditors  detennined  the  identified  fraud  to  be  an  isolated  incident  not  indicative 
of  a  systemic  internal  control  risk  and  therefore,  they  did  not  believe  that  additional  effort  was 
warranted.  However,  there  was  no  documented  evidence  to  support  the  DCAA  conclusion.  At  a 
minimum,  we  believe  that  the  auditors  should  have  designed,  perfonned,  and  documented 
additional  procedures  to  assess  the  potential  significance  of  this  specific  risk  and  the  existence 
and  effectiveness  of  internal  controls  designed  to  prevent  and  detect  this  risk  of  labor 
mischarging. 

Neither  the  DCAA  Contract  Audit  Manual  Chapter  4-700  “Responsibilities  for  Detection  and 
Reporting  of  Suspected  Irregularities”,  Chapter  13  “Audits  at  Educational  Institutions,  Nonprofit 
Organizations,  and  Federally  Funded  Research  and  Development  Centers,”  nor  the  DCAA 
standard  A- 133  audit  program  contain  sufficient  guidance  or  procedures  to  ensure  that  auditors 


2  DCAA  Field  Detachment  Offices  perform  contract  audits  related  to  sensitive  compartmented  information  and 
special  access  programs. 
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perform  procedures  on  the  consideration  of  fraud  in  a  single  audit  in  accordance  with  auditing 
standards. 

Reporting  Fraud  in  the  Circular  A-133  Audit  Report.  The  DCAA  auditors  did  not 
report  the  identified  fraud  as  an  audit  finding  in  the  single  audit  report  schedule  of  findings  and 
questioned  costs  in  accordance  with  Circular  A-133  reporting  requirements.  Circular  A-133 

§ _ .5 10(a)(6)  states  that  the  auditor  shall  report  “known  fraud  affecting  a  Federal  award,  unless 

such  fraud  is  otherwise  reported  as  an  audit  finding  in  the  schedule  of  findings  and  questioned 
costs  for  Federal  awards.” 

Based  on  our  review  of  the  DCAA  Contract  Audit  Manual  Chapter  13  “Audits  at  Educational 
Institutions,  Nonprofit  Organizations,  and  Federally  Funded  Research  and  Development 
Centers,”  we  were  unable  to  find  any  guidance  specific  to  reporting  fraud  in  accordance  with 
OMB  Circular  A-133  requirements. 

The  working  papers  support  that  DCAA  verified  that  the  fraud  was  under  investigation. 
Therefore,  the  main  focus  of  our  quality  control  review  was  the  lack  of  disclosure  in  the  DCAA 
audit  report  of  the  known  fraud  and  DCAA’s  failure  to  follow  standards  and  design  additional 
steps  related  to  the  known  fraud. 

Evaluation  and  Reporting  of  a  Deficiency  in  Internal  Control  over  Compliance  with 
Cash  Management  Requirements.  DCAA  did  not  properly  evaluate  and  report  a  finding  in 
internal  control  disclosed  during  the  review  of  the  internal  control  over  compliance  with  the  cash 
management  requirements. 

OMB  Circular  A-133  § _ .510  (a)(1)  requires  the  auditor  to  report  significant  deficiencies  in 

internal  control  over  compliance  as  an  audit  finding  in  the  Federal  awards  section  of  the  schedule 
of  findings  and  questioned  costs. 

DCAA  relied  on  the  internal  control  testing  performed  in  the  FY  2008  direct  billing  review  for 
the  review  of  cash  management  requirements.  The  objectives  in  the  direct  billing  review 
included  determining  whether  Aerospace  had  effective  controls  to  ensure  that  award  costs  billed 
to  the  government  on  a  reimbursement  basis  reflected  actual  incurred  cost.  The  auditor 
identified  and  tested  four  key  internal  controls  intended  to  prevent  noncompliance  with  this 
requirement.  One  of  the  key  controls  tested  was  that  billing  requests  contained  the  appropriate 
level  of  management  approval  as  required  under  Aerospace  policies  and  procedures.  The 
auditors  sampled  sixteen  billings  and  found  that  three  billings  were  not  approved  by  management 
prior  to  requesting  reimbursement  from  Federal  agencies.  All  the  exceptions  were  for  web 
invoice  and  phone  automated  billings  for  Department  of  Justice,  National  Aeronautics  and  Space 
Administration,  and  National  Science  Foundation  grants.  DCAA  discussed  the  exceptions  with 
the  Aerospace  representative  who  acknowledged  that  management  approvals  were  not  obtained 
for  web  invoice  and  phone  automated  billings  and  the  representative  stated  that  this  would  be 
corrected  for  future  billings. 

In  evaluating  whether  to  report  the  identified  deficiency,  the  auditor  noted  that  Aerospace  had  a 
compensating  control,  the  Monthly  Account  Reconciliation  Report,  wherein  managers  approve 
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the  reconciliation  of  costs  billed  to  the  general  ledger.  DCAA  stated  that  they  considered  this 
[control]  sufficient  to  satisfy  the  requirement  for  management  approval  prior  to  submitting 
reimbursement  requests.  There  was  no  documentation  in  the  DCAA  working  papers  to  explain 
how  the  Monthly  Account  Reconciliation,  an  after-the-fact  procedure,  compensated  for  the  lack 
of  approval  required  prior  to  reimbursement  requests.  In  addition,  there  was  no  documentation 
to  support  that  the  auditors  performed  any  testing  of  the  compensating  control  to  ensure  its 
operating  effectiveness. 

The  AICPA  auditing  standard  AU  §325A.14  states  that  an  effective  compensating  control  limits 
the  severity  of  a  control  deficiency  and  prevents  it  from  rising  to  the  level  of  a  significant 
deficiency  or  a  material  weakness.  These  standards  also  state  that  to  rely  on  a  compensating 
control  to  mitigate  the  severity  of  a  control  deficiency,  the  compensating  control  should  be  tested 
and  evaluated  as  to  its  operating  effectiveness. 

We  requested  additional  infonnation  and  documentation  to  support  the  auditors’  reliance  on  the 
compensating  control.  However,  DCAA  did  not  provide  any  documentation  to  support  the  basis 
for  their  acceptance  of  the  Monthly  Account  Reconciliation  as  a  compensating  control  or  provide 
support  for  the  actual  testing  of  the  control.  As  a  result,  the  lack  of  management  approval  of 
billings  prior  to  requesting  reimbursement  from  Federal  agencies  should  have  been  reported  as  a 
significant  deficiency  in  the  audit  report  in  accordance  with  Circular  A- 133  requirements. 

Performance  and  Documentation  of  Planned  Testing  of  Information  Technology 
Internal  Controls.  DCAA  did  not  complete  the  testing  of  key  information  technology  controls 
as  planned  and  the  documentation  did  not  provide  a  clear  understanding  of  the  audit  work 
performed  or  the  procedures  relied  on.  Auditing  standards  require  auditors  to  obtain  an 
understanding  of  infonnation  technology  controls  that  are  relevant  to  planning  the  audit  and, 
when  there  is  an  expectation  that  the  auditor  will  rely  on  those  controls,  require  the  auditor  to 
perform  tests  of  the  controls  to  determine  their  operating  effectiveness. 

The  DCAA  planning  and  risk  assessment  documentation  clearly  indicate  that  the  auditors 
planned  to  rely  on  computer-based  data  in  the  performance  of  the  single  audit.  The 
documentation  identified  five  specific  key  infonnation  technology  system  internal  controls  areas 
that  DCAA  planned  to  test  to  determine  if  the  infonnation  system  controls  were  effective  and 
could  be  relied  upon.  The  five  control  areas  were:  edit  checks;  exception  reporting;  access 
controls;  reviews  of  input  and  output  data;  and  computer  general  controls  and  security  controls. 
Based  on  the  audit  documentation  and  several  discussions  with  the  supervisory  auditor,  the 
auditors  conclusions  on  information  technology  controls  were  based  on  reliance  on  work 
performed  by  Deloitte  &  Touche  in  the  FY  2008  financial  statement  audit  and  on  the  following 
additional  DCAA  audits:  “ODC  and  Indirect  Cost  IT  Controls”  perfonned  in  FY  2005; 
“Accounting  System  IT  Controls”  and  “Billing  System  IT  Controls”  audits  performed  in  FY 
2006;  two  FY  2008  floorcheck  audits  and  an  ongoing  FY  2008  direct  billing  evaluation. 

Circular  A- 133  requires  annual  testing  of  controls;  therefore,  the  testing  perfonned  in  the  FY 
2005  and  FY  2006  reviews  do  not  fulfill  the  current  audit  requirement.  We  discussed  this  with 
the  supervisory  auditor  who  advised  us  that,  although  not  clearly  documented  in  the  audit 
working  papers,  the  FY  2005  and  2006  review  infonnation  was  provided  only  for  historical 
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purposes.  In  addition,  we  were  unable  to  find  documentation  in  the  FY  2008  floorchecks  and 
billing  system  reviews  to  provide  any  support  for  testing  key  infonnation  technology  internal 
controls.  Therefore,  based  on  our  review  of  the  documentation,  the  only  adequate  source  of 
reliance  was  the  audit  work  performed  by  Deloitte  &  Touche. 

DCAA  did  review  and  document  the  procedures  and  results  of  the  Deloitte  &  Touche  audit  of  the 
Aerospace  information  technology  system  internal  controls.  The  supervisory  auditor  explained 
that  DCAA  relied  on  the  Deloitte  &  Touche  audit  for  testing  of  the  five  key  controls.  However, 
based  on  our  independent  review  of  the  Deloitte  &  Touche  audit  and  the  DCAA  audit 
documentation,  we  found  no  evidence  of  testing  for  two  of  the  five  key  controls:  edit  checks  and 
exception  reporting  key  controls.  We  discussed  this  with  the  supervisory  auditor  who  advised  us 
that,  in  hindsight,  the  DCAA  FY  2008  approach  was  incorrect  and  they  did  not  have  to  rely  on 
these  two  control  areas  [to  gain  reliance  on  the  integrity  of  information  produced  by  the 
Aerospace  financial  system]. 

Working  Paper  Documentation.  DCAA  did  not  adequately  document  the  internal 
controls  tested  for  the  cash  management  and  special  tests  and  provisions  requirements,  the 
criteria  used  for  activities  allowed  or  unallowed  and  allowable  costs/cost  principles  compliance 
testing,  and  the  coordination  of  the  scope  of  audit  work  performed  by  the  DCAA  Field 
Detachment  office.  In  addition,  the  audit  file  contained  a  voluminous  amount  of  work  papers, 
many  of  which  simply  duplicated  the  same  infonnation.  Although  we  acknowledge  that  the 
auditors  believed  that  they  were  providing  a  good  audit  trail,  we  found  the  fonnat  and  content  of 
the  working  papers  lacked  clarity  and  contributed  to  instances  of  inconsistencies  between 
working  papers  and  the  lack  of  required  infonnation  in  other  working  papers.  As  a  result  of  the 
documentation  inadequacies,  we  spent  considerable  time  obtaining  verbal  explanations  and 
reviewing  additional  information  provided  by  the  auditors  in  order  to  determine  if  there  was 
sufficient  evidence  to  support  the  audit  conclusions  on  the  four  compliance  requirements  audited 
by  DCAA. 

Auditing  standards  require  that  audit  documentation  be  appropriately  detailed  to  provide  a  clear 
understanding  of  the  work  perfonned  and  the  significant  audit  judgments  and  conclusions 
reached.  The  documentation  should  be  in  sufficient  detail  to  enable  an  experienced  auditor  to 
understand  the  nature,  timing,  and  extent  of  audit  procedures  and  the  evidence  obtained  and  its 
source. 


Cash  Management  and  Special  Tests  and  Provisions  Internal  Control 
Documentation.  The  DCAA  auditors  did  not  adequately  document  the  internal  controls  they 
relied  on  to  support  conclusions  on  the  adequacy  of  controls  for  the  cash  management  and 
special  tests  and  provisions  requirements.  Specifically,  the  working  papers  state  that  the  auditors 
planned  to  rely,  in  part,  on  internal  controls  tested  in  the  review  of  activities  allowed  or 
unallowed  and  allowable  costs/cost  principles  requirements.  However,  the  working  papers  did 
not  provide  a  link  to  the  specific  controls  tested  that  would  satisfy  the  internal  control  objectives 
for  the  cash  management  and  special  tests  and  provisions  requirements.  The  auditors 
subsequently  provided  a  cross-reference  to  the  controls  tested  for  activities  allowed  or  unallowed 
and  allowable  costs/cost  principles  controls  that  DCAA  relied  on  to  support  the  audit 
conclusions.  Without  this  cross-reference  we  would  not  have  been  able  to  detennine  the 
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adequacy  of  the  procedures  performed  or  the  evidence  obtained  to  support  the  auditor’s 
conclusions. 

Testing  Compliance  for  Activities  Allowed  or  Unallowed  and  Allowable  Costs/Cost 
Principles  Compliance  Requirements.  The  DCAA  auditors  did  not  adequately  document  the 
review  of  compliance  for  the  activities  allowed  or  unallowed  and  allowable  costs/cost  principles 
requirements.  Specifically,  the  documentation  did  not  identify  the  specific  cost  principle  criteria 
used  to  review  costs  for  allowability;  did  not  provide  the  basis  for  the  judgment  that  internal 
control  exceptions  noted  during  floorchecks  were  not  considered  significant;  and  did  not 
document  the  procedures  perfonned  and  the  results  of  those  procedures  to  verify  the  existence  of 
employees  not  present  during  the  floorchecks.  In  addition,  the  auditors  did  not  document  that 
they  verified  the  timecard  authorizations  within  the  electronic  timekeeping  system.  The  auditors 
subsequently  provided  additional  explanations  and  documentation  to  support  their  conclusions. 

Field  Detachment  Coordination.  The  DCAA  working  papers  did  not  adequately 
document,  as  required  by  government  auditing  standards  and  DCAA  policy,  the  coordination 
with  DCAA  Field  Detachment  or  clearly  identify  the  audit  work  perfonned  by  the  Field 
Detachment  auditors.  DCAA  Instruction  No.  7643.1,  “Audit  Coordination  Between  Regional 
and  Field  Detachment  Offices,”  dated  July  27,  2007,  requires  the  Branch  Manager  and 
supervisory  auditor  to  maintain  adequate  written  documentation  of  the  coordination  with  Field 
Detachment  during  audit  planning  and  perfonnance. 

The  DCAA  coordination  matrix  documents  an  audit  scope  for  Field  Detachment  that  differs  from 
the  scope  reported  in  the  Field  Detachment  audit  report,  dated  July  16,  2009.  The  coordination 
matrix  indicates  that  Field  Detachment  was  responsible  for  the  direct  cost  testing  of  the  activities 
allowed  or  unallowed  and  the  allowable  costs/cost  principles;  cash  management;  and  special  tests 
and  provisions  compliance  requirements,  while  the  audit  report  states  that  the  auditors  reviewed 
other  direct  costs,  which  includes  direct  travel,  professional  fees  (consultants  and  contract  labor), 
special  purpose  plant  equipment,  and  other  direct  costs.  The  working  papers  do  not  document 
the  reason(s)  for  the  scope  change.  In  addition,  we  could  not  detennine  from  the  working  papers 
whether  the  Field  Detachment  was  responsible  for  perfonning  audit  procedures  only  on  awards 
under  their  cognizance  or  whether  the  Field  Detachment  scope  also  included  awards  under  the 
South  Bay  Branch  Office  cognizance.  As  a  result,  we  were  unable  to  determine  if  there  was  a 
gap  in  audit  coverage  that  would  impact  the  adequacy  of  the  DCAA  opinion.  Through 
discussions  with  the  Branch  Office  and  Field  Detachment  supervisory  auditors,  we  detennined 
that,  although  not  clearly  documented,  the  Field  Detachment  scope  included  other  direct  costs  for 
all  Aerospace  awards  and  the  Branch  scope  included  direct  costs  for  all  Aerospace  awards. 


Conclusion:  The  deficiencies  disclosed  by  our  review  indicate  that  DCAA  management  needs  to 
implement  more  effective  quality  control  procedures  for  the  Circular  A- 133  audits  and  provide 
additional  training  in  auditing  standards  and  OMB  Circular  A- 133  requirements  to  auditors 
perfonning  OMB  Circular  A- 133  audits. 

Recommendations  and  Management  Comments 
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1. 


We  recommend  that  the  Director,  Defense  Contract  Audit  Agency: 


a.  Revise  the  Defense  Contract  Audit  Agency  Circular  A-133  standard  audit 
program  to  include  the  procedures  required  by  the  American  Institute  of 
Certified  Public  Accountants’  Statements  on  Auditing  Standards  §316, 
“Consideration  of  Fraud  in  a  Financial  Statement  Audit.” 

b.  Revise  the  DCAA  Contract  Audit  Manual  Chapter  13,  “Audits  at 
Educational  Institutions,  Nonprofit  Organizations,  and  Federally  Funded 
Research  and  Development  Centers  (FFRDCs),”  to  include  guidance  on 
performing  fraud  risk  assessment  procedures  and  reporting  in  the  Circular 
A-133  audit  report. 

DCAA  Comments.  The  Director,  DCAA  agreed  to  take  the  recommended  actions. 

Management  comments  are  included  in  their  entirety  at  the  end  of  this  report. 

2.  We  recommend  that  the  Branch  Manager,  South  Bay  Branch,  Defense  Contract 
Audit  Agency 

a.  Revise  the  FY  2008  Defense  Contract  Audit  Agency  audit  report  to  include 
the  findings  related  to  the  fraud  identified  by  Aerospace  management  and 
the  significant  deficiency  in  internal  control  over  compliance  with  cash 
management  requirements  in  the  schedule  of  findings  and  questioned  costs. 

b.  Forward  the  revised  report  to  the  Aerospace  Corporation  for  submission  to 
the  Federal  Audit  Clearinghouse. 

c.  Strengthen  existing  or  implement  additional  quality  control  procedures  for 
Offices  of  Management  and  Budget  Circular  A-133  audits  to  ensure  that 
future  audits  comply  with  auditing  standards  and  Circular  A-133 
requirements  for  the  planning,  performance  and  documentation  of  the  audit. 

d.  Provide  staff  performing  Circular  A-133  audits  formal  training  in  the 
application  and  implementation  of  auditing  standards  in  meeting  Circular 
A-133  audit  requirements. 

DCAA  Comments.  The  Branch  Manager,  South  Bay  Branch,  DCAA  agreed  to  take  the 

recommended  actions.  Management  comments  are  included  in  their  entirety  at  the  end  of  this 

report. 

3.  We  recommend  that  the  Vice  President,  Chief  Financial  Officer,  and  Treasurer,  The 
Aerospace  Corporation,  within  30  days  of  receipt  of  the  revised  report  from  the 
DCAA,  file  the  revised  FY  2008  Circular  A-133  reporting  package  and  Data 
Collection  Form  with  the  Federal  Audit  Clearinghouse  and  notify  the  DoD  Office  of 
Inspector  General  upon  completion. 
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The  Aerospace  Corporation  Comments.  The  Aerospace  Corporation  did  not  provide  formal 
comments  to  the  draft  report.  However,  The  Vice  President,  Chief  Financial  Officer,  and 
Treasurer,  The  Aerospace  Corporation  agreed  in  an  email  to  take  the  recommended  actions. 

Other  Matters  of  Interest.  The  DCAA  Contract  Audit  Manual  Chapter  13,  “Audits  at 
Educational  Institutions,  Nonprofit  Organizations,  and  Federally  Funded  Research  and 
Development  Centers,”  section  700,  “OMB  Circular  A- 133  Audits  and  Reports,”  should  be 
updated  to  reflect  the  current  terminology  on  communicating  matters  related  to  internal  control 
in  accordance  with  OMB  Circular-  A-133  reporting  requirements.  Specifically,  effective  with  the 
June  26,  2007  Federal  Register  changes  to  OMB  Circular  A-133,  the  term  “reportable  condition” 
has  been  replaced  with  “significant  deficiency”  to  conform  with  current  auditing  standards. 

DCAA  Comments.  Hie  Director,  DCAA  agreed  to  take  the  recommended  actions. 

Management  comments  are  included  in  their  entirety  at  the  end  of  this  report. 

We  appreciate  the  courtesies  extended  to  the  audit  staff.  For  additional  information  on 
this  report,  please  contact  Ms.  Janet  Stern  at  (703)  604-8750  (DSN  664-8750). 

Randolph  R.  Stone 
Deputy  Inspector  General 
for  Policy  and  Oversight 
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Appendix  A.  Quality  Control  Review  Process 

Background,  Scope  and  Methodology 

The  Single  Audit  Act,  Public  Law  98-502,  as  amended,  was  enacted  to  improve  the  financial 
management  of  State  and  Local  Governments  and  nonprofit  organizations  by  establishing  one 
uniform  set  of  auditing  and  reporting  requirements  for  all  Federal  award  recipients  required  to 
obtain  a  single  audit.  Circular  A- 133  establishes  policies  that  guide  implementation  of  the  Single 
Audit  Act  and  provides  an  administrative  foundation  for  uniform  audit  requirements  of  non- 
Federal  entities  administering  Federal  awards.  Entities  that  expend  $500,000  or  more  are  subject 
to  the  Single  Audit  Act  and  the  audit  requirements  in  Circular  A- 133  and  therefore  must  have  an 
annual  single  or  program-specific  audit  perfonned  under  Government  Auditing  Standards  and 
submit  a  complete  reporting  package  to  the  Federal  Audit  Clearinghouse. 

We  reviewed  the  Deloitte  &  Touche,  LLP  and  Defense  Contract  Audit  Agency  FY  2008  single 
audit  of  The  Aerospace  Corporation  and  the  reporting  package  that  was  submitted  to  the  Federal 
Audit  Clearinghouse  on  July  30,  2009,  using  the  1999  edition  of  the  “Uniform  Quality  Control 
Guide  for  the  A-133  Audits”  (the  Guide).  The  Guide  applies  to  any  single  audit  that  is  subject  to 
the  requirements  of  Circular  A-133  and  is  the  approved  President’s  Council  on  Integrity  and 
Efficiency  checklist  used  for  perfonning  quality  control  reviews.  We  perfonned  the  review 
from  September  2009  through  August  2010.  The  review  focused  on  the  following  qualitative 
aspects  of  the  single  audit: 

•  Qualification  of  Auditors, 

•  Independence, 

•  Due  Professional  Care, 

•  Planning  and  Supervision, 

•  Internal  Control  and  Compliance  testing, 

•  Schedule  of  Expenditures  of  Federal  Awards,  and 

•  Data  Collection  Fonn. 

Prior  Quality  Control  Reviews 

Since  October  1,  2006,  we  have  performed  two  quality  control  reviews  each  of  DCAA  and 
Deloitte  &  Touche  OMB  Circular  A-133  audits.  All  four  audits  contained  deficiencies  resulting 
in  findings  and  recommendations  on  audit  planning/coordination,  performance,  and 


3  The  President’s  Council  on  Integrity  and  Efficiency  and  the  Executive  Council  on  Integrity  and  Efficiency 
combined  into  the  Council  of  the  Inspectors  General  on  Integrity  and  Efficiency  in  accordance  with  the  Inspector 
General  Reform  Act  of  2008. 
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documentation.  Unrestricted  IG  DoD  reports  can  be  accessed  at 
http://www.dodig.mil/audit/reports. 


IG  DoD  Reports 

IG  DoD  Report  No.  D-2009-6-007,  “Report  on  Quality  Control  Review  of  Deloitte  &  Touche, 
LLP  FY  2007  Single  Audit  of  Battelle  Memorial  Institute  and  Subsidiaries”  June  29,  2009 

IG  DoD  Report  No.  D-2008-6-002,  “Quality  Control  Review  of  FY  2006  Single  Audit  of 
Syracuse  Research  Corporation,”  January  25,  2008 

IG  DoD  Report  No.  D-2007-6-007,  “Review  of  South  Carolina  Research  Authority's  FY  2005 
Single  Audit  Performed  by  Deloitte  and  Touche,  LLP”  July  25,  2007 

IG  DoD  Report  No.  D-2006-00 1-002,  “Report  on  Quality  Control  Review  of  the 
PricewaterhouseCoopers  LLP  and  the  Defense  Contract  Audit  Agency  Office  of  Management 
and  Budget  Circular  A- 133  Audit  Report  of  the  RAND  Corporation,  Fiscal  Year  Ended 
September  29,  2002”  December  16,  2005 
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Appendix  B.  Compliance  Requirements* 


OMB  Circular  A-133  Compliance  Requirements 

Applicable 

Not 

Applicable 

DCAA 

Deloitte 

Activities  Allowed/Unallowed 

X 

Allowable  Costs/Cost  Principles 

X 

Cash  Management 

X 

Davis-Bacon  Act 

X 

Eligibility 

X 

Equipment  and  Real  Property  Management 

X 

Matching,  Level  of  Effort,  Earmarking 

X 

Period  of  Availability  of  Federal  Funds 

X 

Procurement,  Suspension,  and  Debannent 

X 

Program  Income 

X 

Real  Property  Acquisition  and  Relocation  Assistance 

X 

Reporting 

X 

Subrecipient  Monitoring 

X 

Special  Tests  and  Provisions 

X 

*The  auditors  determine  whether  a  compliance  requirement  is  applicable  or  not  to  the 
audited  organization. 


12 


Defense  Contract  Audit  Agency  Management 
Comments 


MEMORANDUM  FOR  DEPARTMENT  OF  DEFENSE,  OFFICE  OF  INSPECTOR 

GENERAL.  DEPUTY  INSPECTOR  GENERAL  FOR  AUDIT 
POLICY  AND  OVERSIGHT 


ATTENTION:  Mr.  Randolph  R.  Stone 


SUBJECT :  Response  to  Department  of  Defense  Office  of  Inspector  General  (DoDIG )  Draft 
Report,  Quality  Control  Review  of  the  Oeloitte  <£  Touche,  LLP  and  Defense 
Contract  Audit  Agency  FY  2008  Single  Audit  of  The  Aerospace  Corporation,  dated 
September  9,  2010  (Project  No.  D2009-D1PG  AC-0302.000) 


Thank  you  for  the  opportunity  lo  respond  to  the  subject  draft  report.  Quality  Control 
Review  of  the  Deloitte  &  Touche,  LLP  and  Defense  Contract  Audit  Agency  FY  2008  Single  Audit 
of  The  Aerospace  Corporation.  The  following  are  DC AA’s  comments  and  responses  to  each  of 
the  recommendations  impacting  DCAA. 


DoDIG  Recommeudation  l.a:  Wc  recommend  that  the  Director.  Defense  Contract  Audit 
Agency,  revise  the  Defense  Contract  Audit  Agency  Circular  A-133  Standard  Audit  Program  to 
include  the  procedures  required  by  the  American  Institute  of  Certified  Public  Accountants' 
Statements  on  Auditing  Standards  Section  316.  “Consideration  of  Fraud  in  a  Financial  Statement 
Audit." 


DCAA  Response:  Concur.  By  January  201 1.  DCAA  will  revise  the  A-133  Standard  Audit 
Program  lo  include  the  procedures  required  by  the  American  Institute  of  Certified  Public 
Accountants’  Statements  on  Auditing  Standards  Section  316,  "Consideration  of  Fraud  in  a 
Financial  Statement  Audit.”  DCAA  will  also  add  additional  procedures  on  reporting  identified 
fraud,  in  accordance  with  OMB  Circular  A-133  SccLon  .510(a)(6)  and  GAGAS  Section  5.10. 


DoDIG  Recommendation  l.b:  Wc  recommend  that  the  Director,  Defense  Contract  Audit 
Agency,  revise  the  DCAA  Contract  Audit  Manual  Chapter  13.  “Audits  at  Educational 
Institutions,  Nonprofit  Organizations .  and  federally  Funded  Research  and  Developmeni  Centers 
(Fl  RUCs),”  Lo  include  guidance  on  performing  fraud  risk  assessment  procedures  and  reporting 
in  the  Circular  A-l  33  audit  report. 


DCAA  Response:  Concur.  By  January  201 1,  DCAA  will  update  the  Contract  Audit  Manual, 
Chapter  13.  lo  provide  guidance  on  performing  fraud  risk  assessment  procedures  and  reporting  in 
the  A- 131  audit  report,  in  accordance  with  OMB  Circular  A-133  and  AICPA  Auditing  Standard 
3 1 6  requirements. 


DEFENSE  CONTRACT  AUDIT  AGENCY 
DEPARTMENT  OF  DEFENSE 

R725  JOHN  J.  KINGMAM  ROAD.  SUITE  2135 
FORT  BFI  VOIR.  V  \  22060-62IV 


OFFICE  OF  THE  DIRECTOR 


October  12,  2010 


PPD  225.4  (D2009-DIPOAC-0302.000)  October  12,  2010 

SUBJECT:  Response  to  Department  of  Defense  Office  oflnspeclor  General  (DoDIG)  Draft 
Report,  Quality  Control  Review  of  the  Deloitle  <£  Touche,  LLP  and  Defense 
Contract  Audit  Agency  FY  2008  Single  Audit  of  The  Aerospace  Corporation ,  dated 
September  9, 2010  (Project  No.  D2009-DIPOAC-0302.000) 

DoDIG  Recommendation  2. a:  We  recommend  that  the  Branch  Manager,  South  Bay  Branch, 
Defense  Contract  Audit  Agency  revise  the  FY  2008  Defense  Contract  Audit  Agency  audit  report 
to  include  tile  findings  related  to  the  fraud  identified  by  Aerospace  management  and  the 
significant  deficiency  in  internal  control  over  compliance  with  cash  management  requirements  in 
the  schedule  of  findings  and  questioned  costs. 

DCAA  Response:  Concur.  The  FAO  will  issue  by  December  31,  2010  a  supplemental  FY  2008 
report  to  include  the  findings  related  to  the  fraud  identified  by  Aerospace  management  and  the 
significant  deficiency  in  internal  control  over  compliance  with  cash  management  requirements  in 
the  schedule  of  findings  and  questioned  costs. 

DoDIG  Recommendations  2.b:  We  recommend  that  the  Branch  Manager,  South  Bay  Branch, 
Defense  Contract  Audit  Agency  forward  the  revised  report  to  the  Aerospace  Corporation  for 
submission  to  the  Federal  Audit  Clearingltonse. 

DCAA  Response:  Concur.  The  FAO  will  provide  the  Aerospace  Corporation  a  copy  of  the 
supplemental  report  for  submission  to  the  Federal  Audit  Clearinghouse. 

DoDIG  Recommendations  2.c:  We  recommend  that  the  Branch  Manager,  South  Bay  Branch, 
Defense  Contract  Audit  Agency  strengthen  existing  or  implement  additional  quality  control 
procedures  for  Office  of  Management  and  Budget  Circular  A-133  audits  to  ensure  that  future 
audits  comply  with  auditing  standards  and  Circular  A-133  requirements  for  the  planning, 
performance  and  documentation  of  the  audit. 

DCAA  Response:  Concur.  By  December  3 1 ,  21)10,  the  FAO  will  re-evaluate  its  quality  control 
procedures  specifically  as  they  relate  to  A-l  33  audits  and  develop  enhancements  as  necessary  to 
ensure  future  audits  arc  planned,  performed,  documented,  and  reported  in  compliance  with  all 
applicable  auditing  standards  and  Circular  A-l  33  requirements  Current  quality  control 
procedures,  developed  in  accordance  with  Western  Region  Instruction  No.  7640.7,  require  that 
OMB  Circular  A-133  audit  assignments  and  reports  be  reviewed  and  approved  by  the  regional 
audit  manager  (RAM)  prior  to  report  issuance.  Additionally,  management  will  immediately 
begin  requiring  a  peer  review  be  conducted  on  A-133  audit  workingpapers  by  a  supervisory 
auditor  or  FAO  special  assistant  for  quality  independent  of  the  A- 1 33  audit  to  ensure  planned 
audit  steps  are  performed  and  appropriately  documented. 

DoDIG  Recommendations  2.d:  We  recommend  that  the  Branch  Manager,  South  Bay  Branch, 
Defense  Contract  Audit  Agency  provide  staff  performing  Circular  A-133  audit  formal  training  in 
the  application  and  implementation  of  auditing  standards  in  meeting  Circular  A-133  audit 
requirements. 

DCAA  Response:  Concur.  The  FAO  will  ensure  that  auditors  and  supervisors  performing 
OMB  Circular  A- 1 33  compliance  audits  have  training  in  the  application  and  implementation  of 
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PPD  225.4  (D2009-DIPOAC-0302.000)  October  12 .  .  2010 

SUBJECT:  Response  to  Department  of  Defense  Office  of  Inspector  General  (DoDIG)  Draft 
Report,  Quality  Control  Review  of  the  Deloitte  d£  Touche,  LLP  and  Defense 
Contract  Audit  Agency  FY  2008  Single  Audit  of  The  Aerospace  Corporation ,  dated 
September  9.  2010  (Project  No.  D2009-DIP0AC-0302.000) 


auditing  standards  in  meeting  Circular  A-133  audit  requirements  in  accordance  with  GAGAS 
3.40  and  DC AA  ViRD  08-PPD-031(R),  dated  October  2,  2008  by  December  31,  2010.  The  FAO 
will  present  the  specific  DoDIG  findings  to  auditors  performing  A-133  audits  by  November  30, 
2010. 


Please  see  the  enclosed  Western  Region,  DCAA,  Responses  to  the  DoDIG  Draft  report 
for  more  detailed  responses  to  DoDIG  Recommendation  2. 


DoDIG  Other  Matters  of  Interest:  The  DCAA  Contract  Audit  Manual,  Chapter  13,  Audits  at 
Educational  Instiiuu'ons,  Nonprofit  Organizations,  and  Federally  Funded  Research  and 
Development  Centers,  Section  700,  “OMR  Circular  A-133  Audits  and  Reports/*  should  be 
updated  to  reflect  the  current  terminology  on  communicating  matters  related  to  internal  control, 
in  accordance  with  OMB  Circular  A-133  reporting  requirements.  Specifically,  effective  with  the 
June  26,  2007  Federal  Register  changes  to  OMB  Circular  A-133.  the  term  “reportable  condition*’ 
has  been  replaced  with  “significant  deficiency”  to  conform  with  current  auditing  standards. 

DCAA  Response  to  DoDIG  Other  Matters  of  Interest:  DCAA  will  update  the  Contract  Audit 
Manual,  Chapter  13,  Section  700  for  the  change  in  terminology  on  communicating  matters 
related  to  internal  control,  in  accordance  with  OMB  Circular  A-133  reporting  requirements. 


Questions  regarding  this  memorandum  should  be  directed  to  Ms.  Esther  Fischer,  Chief 
Policy  Programs  Division  at  (703)  767-2297 


Patrick  J. (Fitzgerald 
Director 


Enclosure: 

DCAA  Western  Region  Response 
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WESTERN  REGION 

DEFENSE  CONTRACT  AUDIT  AGENCY 

16700  VALLEY  VIEW  AVENLL,  SUITE  300 
LA  MIRADA.  CALIFORNIA  00638-5833 


IN  Ml  PI  V  mil  TO 


RS-4  225.4  October  6, 20 1 0 

MEMORANDUM  FOR  DIRECTOR,  DCAA 
ATTENTION:  PPD  (Esther  Fischer) 

SUBJECT:  Response  to  DoDIG  Preliminary  Review  Results  -  Report  on  Quality  Control 

Review  of  Deloitte  &  Touche.  LLP  and  Defense  Contract  Audit  Agency  FY  2008 
Single  Audit  of  the  Aerospace  Corporation  (Project  No.  D2009-D1PUAC-0302.UIK)) 

Wchavc  reviewed  the  subject  DoDIG  drat)  report  findings  and  recommendations 
regarding  DCAA  FY  2008  Single  Audit  of  the  Aerospace  Corporation  The  DoDIG's  overall 
conclusion  was  that  DCAA  did  not  comply  with  Circular  A- 133  reporting  requirements.  Our 
response  to  the  DoDIG  findings  and  recommendations  as  they  relate  to  the  South  Bay  Branch 
Office  follows: 

RESPONSE  TO  DoDIG  DRAFT  RECOMMENDATIONS: 

DoDIG  Recommendations  2a:  We  recommend  that  the  Branch  Manager,  South  Bay 
Branch  Office.  Defense  Contract  Audit  Agency,  revise  the  FY  2008  Defense  Contract  Audit 
Agency  audit  report  to  include  the  findings  related  to  the  fraud  identified  by  Aerospace 
management  and  the  significant  deficiency  in  internal  control  aver  compliance  with  cosh 
management  requirements  in  the  schedule  of  findings  and  questioned  costs. 

DCAA  Response:  Concur.  The  FAO  will  issue  by  December  31,  2010  a  supplemental 
1Y  2008  report  to  include  the  findings  related  to  the  fraud  identified  by  Aerospace  management 
and  the  significant  deficiency  in  interna)  control  over  compliance  with  cash  management 
requirements  in  the  schedule  of  findings  and  questioned  costs. 

During  our  FY  2008  OMB  Circular  A-133  audit  of  the  Aerospace  Corporation,  the  FAO 
was  informed  that  an  instance  of  potential  fraud  was  identified  and  reported  to  the  DoDIG  by 
Aerospace.  The  FAO’s  interpretation  of  the  requirements  of  Circular  A-133  was  that  the 
potential  fraud  was  not  required  to  be  reported  Paragraph  510(a)(6)  of  the  circular  states 

This  paragraph  docs  not  require  the  auditor  to  make  an  additional 
reporting  when  the  auditor  confirms  that  the  fraud  was  reported 
outside  of  the  auditor's  reports  under  file  direct  reporting 
requirements  of  GAGAS. 
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The  auditors  confirmed  that  Aerospace  took  appropriate  action  and  reported  the  potential 
fraud  to  those  charged  with  governance  as  required  Therefore,  the  FAO  concluded  at  the  time 
that  the  requirement  for  additional  reporting  was  not  required  under  GAGAS  5. 1 8.  Nevertheless, 
the  report  will  be  revised  as  recommended 

In  addition,  tile  FAO  has  initiated  corrective  actions  during  its  audit  of  the  Aerospace  FY 
2009  OMB  Circular  A- 1 33  audit  in  response  to  IG  comments  provided  during  the  course  of  the 
FY  2008  QCR  review.  The  FAO  has  included  the  procedures  required  by  the  American  Institute 
of  Certified  Public  Accountants’  Statements  on  Auditing  Standards  Section  316,  '“Consideration 
of  Fraud  in  a  Financial  Statement  Audit"  and  will  report  identified  fraud  in  accordance  with 
OMB  Circular  A-133  Section  .510(a)(6)  and  GAGAS  Section  5.10,  if  applicable. 

DoDIG  Recommendations  2b;  if  e  recommend  that  Hie  Branch  Manager,  South  Bin 
Branch  Office.  Defense  Contract  Audit  Agency  forward  the  revised  report  to  the  Aerospace 
Corporation  for  submission  to  the  Federal  Audit  Clearinghouse 

DCAA  Response:  Concur.  The  FAO  will  provide  the  Aerospace  Corporation  a  copy  of 
the  supplemental  report  for  submission  to  the  Federal  Audit  Clearinghouse. 

DnDIG  Recommendations  2c:  H'e  recommend  that  the  Branch  Manager,  South  Bay 
Branch  Office.  Defense  Contract  Audit  Agency,  strengthen  existing  or  implement  additional 
ipiality  control  procedures  for  Office  of  Management  and  Budget  Circular  A-133  audits  to 
ensure  that  future  audits  comply  with  auditing  standards  and  Circular  A-133  requirements  for 
the  planning,  performance  and  documentation  of  the  audit. 

DCAA  Response.  Concur.  By  December  3 1 ,  201 0,  the  FAO  will  rc-cvaluate  its  quality 
control  procedures  specifically  as  they  relate  to  A-133  audits  and  develop  enhancements  as 
necessary  to  ensure  future  audits  are  planned,  performed,  documented,  and  reported  in 
compliance  with  all  applicable  auditing  standards  and  Circular  A-133  requirements.  Current 
quality  control  procedures,  developed  in  accordance  with  Western  Region  Instruction  No. 
7640.7,  require  that  OMB  Circular  A-133  audit  assignments  and  reports  be  reviewed  and 
approved  by  the  regional  audit  manager  (RAM)  prior  to  report  issuance.  Additionally, 
management  will  immediately  begin  requiring  a  peer  review  be  conducted  on  A-133  audit 
working  papers  by  a  supervisory  auditor  or  l'AO  special  assistant  for  quality  independent  of  the 
A-133  audit  to  ensure  planned  audit  steps  are  performed  and  appropriately  documented. 

DuDIG  Recommendations  2d;  IVe  recommend  that  the  Branch  Manager.  South  Bay 
Branch  Office.  Defense  Contract  Audit  Agency,  provide  staff  performing  Circular  A-l  33  audit 
formal  training  in  the  application  and  implementation  of  auditing  standards  in  meeting  Circular 
I -133  audit  requirements. 

DCAA  Response;  Concur.  The  FAO  will  ensure  that  auditors  and  supervisors 
performing  OMB  Circular  A-133  compliance  audits  have  training  in  the  application  and 
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implementation  ol  auditing  standards  in  meeting  Circular  A- 133  audit  requirements  in 
accordance  with  GAGAS  3.40  and  DC'AA  MRD  08-PPD-031(R),  dated  October  2.  2008.  by 
December  31, 2010  As  of  August  31. 2010,  the  entire  FAO  staff  has  completed  formal  training 
in  GAGAS  developed  by  the  Defense  Contract  Audit  Institute  (DCAA’s  training  facility).  The 
F  AO  will  present  the  specific  DoDIG  Findings  to  auditors  performing  A-133  audits  by  November 
31),  2010. 

ADDITIONAL  COMMENTS  ON  DoDIC  DRAFT  REPORT  NARRATIVE 
DoDIC  Findings; 

Fraud  Risk  Assessment  Procedures  (page  2):  DCAA  did  not  perform  sufficient  fraud 
risk  assessment  procedures  during  the  planning  and  performance  of  the  audit 

FAO  Comment:  the  audit  team  initiated  corrective  actions  during  its  audit  of  the 
Aerospace  FY  2009  OMB  Circular  A-133  audit  in  response  to  IG  comments  provided  during  its 
Quality  Control  Review  (QCR),  The  leant  obtained  and  reviewed  the  Independent  Public 
Accountants  (IPA)  review  of  fraud  risk,  communicated  with  the  auditee.  and  evaluated  the 
potential  impact  of  fraud  indicators  to  determine  additional  procedures  to  be  performed.  The 
FAO  will  continue  to  evaluate  and  enhance  its  procedures  to  adequately  document  the  fraud  risk 
during  planning  and  performance  and  to  design  additional  procedures  as  necessary  lor  the  FY 
2010  A-133  audit  in  accordance  with  AU  316. 

Reporting  Fraud  in  the  Circular  A-133  Audit  Report  (page  3):  The  DCAA  auditors 
did  not  report  the  identified  fraud  as  an  audit  finding  in  the  single  audit  report  schedule  of 
findings  and  questioned  costs  in  accordance  with  Circular  A-l  33  reporting  requirements. 

KAO  Comment:  See  response  above  regarding  the  DoDIG  Recommendation  2a. 

Evaluating  and  Reporting  of  u  Deficiency  in  Internal  Control  over  Compliance  with 
Cash  Management  Requirements  (page  4);  DCAA  did  not  properly  evaluate  and  report  a 
finding  in  internal  control  disclosed  during  the  review  of  the  internal  control  over  compliance 
with  the  cash  management  requirements.  In  addition,  DC'AA  did  not  adequately  document 
rationale  for  its  audit  position  or  llu;  testing  of  compensating  controls. 

FAO  Comment;  The  FAO  will  re-issue  its  report  and  include  the  deficiency  as  a 
significant  internal  control  deficiency.  The  audit  team  will  discuss  the  findings  in  this  report  at 
its  team  meetings  to  ensure  that  team  auditors  understand  the  requirements  of  A-133  as  well  as 
documentation  requirements.  The  FAO  will  also  provide  additional  training  to  all  personnel 
involved  in  the  A-133  audit  to  enhance  work  paper  documentation. 

Performance  and  Documentation  of  Planned  Testing  of  Information  Technology 
Internal  Controls  (page  5):  DCAA  did  not  complete  the  testing  of  key  information  technology 
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controls  as  planned  and  the  documentation  did  not  provide  a  clear  understanding  oj  the  audit 
work  performed  or  the  procedures  relied  on. 

FAO  Response:  Hie  FAQ  will  re-evaluate  the  key  controls  for  information  technology 
testing  and  will  enhance  its  documentation  and  review  process  to  ensure  that  controls  identified 
for  testing  are  clearly  identified  and  testing  performed  is  adequately  and  clearly  documented. 
When  reliance  is  to  be  placed  on  the  IPA  work  performed,  documentation  will  clearly  tie  the 
work  performed  to  the  specific  controls  identified  in  our  planning.  The  FAO  is  currently 
evaluating  available  training  courses  to  enhance  auditors’  knowledge  of  and  procedures  for 
documenting  and  testing  of  internal  controls. 

Cash  Management  and  Special  Tests  and  Provisions  Internal  Control 
Documentation  (page  6):  The  IJCAA  auditors  did  not  adequately  document  the  internal 
controls  they  retied  on  to  support  conclusions  on  the  adequacy  of  controls  for  the  cash 
management  and  special  tests  and  provisions  requirements.  Specifically,  the  working  papers 
state  that  the  auditors  planned  to  rely,  in  part,  on  interna!  controls  tested  in  the  review  of 
activities  allowed  or  unallowed  and  allowable  costs/cost  principle  requirements. 

FAO  Comment:  Based  on  comments  provided  during  the  course  of  the  QCR  review,  the 
auditors  enhanced  the  documentation  in  the  Aerospace  FY  2009  A-133  audit  to  include  specific 
reference  to  controls  identified  and  tested  in  the  review  of  activities  allowed  or  unallowed  and 
allowable  costs/cost  principle  requirements.  The  FAO  has  taken  steps  to  identify  and  eliminate 
work  papers  which  essentially  duplicate  other  work  papers.  The  FAO  will  continue  to  assess  its 
work  paper  structure  to  maintain  a  clear  audit  trail  without  unnecessary  duplication  of 
information. 

resting  Compliance  for  Activities  Allowed  or  Unallowed  and  Allowable  Costs/Cosi 
Principles  Compliance  Requirements  (page  6):  The  DCAA  auditors  did  not  adequately 
document  the  review  of  compliance  for  the  activities  allowed  or  unallowed  and  allowable 
costs/cost  principles  requirements  Specifically  the  documentation  did  not  identify  the  specific 
cost  principle  criteria  used  to  review  costs  for  allowablility;  did  not  provide  the  basis  for  Ihe 
judgment  that  internal  control  exceptions  noted  during  floorchecks  were  not  considered 
significant,  and  did  no I  document  the  procedure  performed  and  the  results  of  those  procedures 
to  verify  the  existence  of  employees  not  present  during  the  floorchecks  In  addition ,  the  auditors 
did  no I  document  lhai  they  verified  the  timecard  authorizations  within  the  electronic  timekeeping 
system 
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FAO  Comment:  Based  on  comments  provided  during  the  course  of  the  QCR  review,  the 
PAO  initialed  actions  to  enhance  documentation  procedures  during  the  Aerospace  EY  2009  A- 
1 13  audit.  We  wall  continue  to  enhance  documentation  and  will  provide  additional  training  to  all 
auditors  involved  in  the  A-133  audit  process. 

Field  Detachment  Coordination  (page  7):  The  DC  A  A  working  papers  did  no I 
adequately  document,  as  required  by  government  auditing  standards  and  DCAA  policy ,  the 
coordination  with  DC  A  A  Field  Detachment  or  dearly  identify  the  audit  work  performed  by  the 
Field  Detachment  auditors, 

KAO  Comment  Based  on  comments  provided  during  the  QCR,  the  KAO  had 
recognized  the  requirement  to  more  clearly  and  specifically  document  the  agreement  reflecting 
the  work  to  be  performed  by  the  Field  Detachment  auditors.  All  future  audits  will  contain 
specific  actions  to  be  taken  by  Field  Detachment  as  part  of  the  documentation  of  coordination  of 
the  audits. 

Please  direct  any  questions  concerning  this  memorandum  to  Ms.  Patricia  A  Wilson. 
Branch  Manager,  South  Bay  Branch  Office,  at  (3 1 0)  965-702U. 


/.?/  Stephen  T.  Larkin 
for/  DONALD  L.  MUM  IN  AX 
Regional  Director 
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